From: Sebastian Ene <sebastianene@google.com>
To: catalin.marinas@arm.com, oupton@kernel.org,
sudeep.holla@kernel.org, will@kernel.org
Cc: jens.wiklander@linaro.org, joey.gouly@arm.com,
kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, android-kvm@google.com,
maz@kernel.org, mrigendra.chaubey@gmail.com,
op-tee@lists.trustedfirmware.org, perlarsen@google.com,
sebastianene@google.com, seiden@linux.ibm.com,
smostafa@google.com, sumit.garg@kernel.org,
suzuki.poulose@arm.com, vdonnefort@google.com,
yuzenghui@huawei.com
Subject: [PATCH v7 6/7] KVM: arm64: Ensure FFA ranges are page aligned
Date: Wed, 17 Jun 2026 14:51:29 +0000 [thread overview]
Message-ID: <20260617145130.3729015-7-sebastianene@google.com> (raw)
In-Reply-To: <20260617145130.3729015-1-sebastianene@google.com>
From: Mostafa Saleh <smostafa@google.com>
At the moment we only check that the size of the range is page
aligned, and truncate the address to the page boundary.
This make an assumption that TZ will do the same.
However, it might decide to use the extra offset of the neighbour
page at the end, which is valid under FFA if NS is using larger
page size.
Harden this check by also checking that the base address is aligned
and reject it otherwise.
Fixes: 436090001776 ("KVM: arm64: Handle FFA_MEM_SHARE calls from the host")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Sebastian Ene <sebastianene@google.com>
---
arch/arm64/kvm/hyp/nvhe/ffa.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index 1a2abd0154c6..d7c5701d0584 100644
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -352,7 +352,7 @@ static u32 __ffa_host_share_ranges(struct ffa_mem_region_addr_range *ranges,
u64 sz = (u64)range->pg_cnt * FFA_PAGE_SIZE;
u64 pfn = hyp_phys_to_pfn(range->address);
- if (!PAGE_ALIGNED(sz))
+ if (!PAGE_ALIGNED(sz | range->address))
break;
if (__pkvm_host_share_ffa(pfn, sz / PAGE_SIZE))
@@ -372,7 +372,7 @@ static u32 __ffa_host_unshare_ranges(struct ffa_mem_region_addr_range *ranges,
u64 sz = (u64)range->pg_cnt * FFA_PAGE_SIZE;
u64 pfn = hyp_phys_to_pfn(range->address);
- if (!PAGE_ALIGNED(sz))
+ if (!PAGE_ALIGNED(sz | range->address))
break;
if (__pkvm_host_unshare_ffa(pfn, sz / PAGE_SIZE))
--
2.54.0.1136.gdb2ca164c4-goog
next prev parent reply other threads:[~2026-06-17 14:52 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-17 14:51 [PATCH v7 0/7] arm_ffa, KVM: Fix FF-A emad offset calculations Sebastian Ene
2026-06-17 14:51 ` [PATCH v7 1/7] optee: ffa: Add NULL check in optee_ffa_lend_protmem Sebastian Ene
2026-06-17 14:51 ` [PATCH v7 2/7] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() Sebastian Ene
2026-06-17 14:51 ` [PATCH v7 3/7] firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Sebastian Ene
2026-06-17 14:51 ` [PATCH v7 4/7] KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() Sebastian Ene
2026-06-17 14:51 ` [PATCH v7 5/7] KVM: arm64: Validate the offset to the mem access descriptor Sebastian Ene
2026-06-17 14:51 ` Sebastian Ene [this message]
2026-06-17 14:51 ` [PATCH v7 7/7] KVM: arm64: Zero out the stack initialized data in the FFA handler Sebastian Ene
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260617145130.3729015-7-sebastianene@google.com \
--to=sebastianene@google.com \
--cc=android-kvm@google.com \
--cc=catalin.marinas@arm.com \
--cc=jens.wiklander@linaro.org \
--cc=joey.gouly@arm.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=mrigendra.chaubey@gmail.com \
--cc=op-tee@lists.trustedfirmware.org \
--cc=oupton@kernel.org \
--cc=perlarsen@google.com \
--cc=seiden@linux.ibm.com \
--cc=smostafa@google.com \
--cc=sudeep.holla@kernel.org \
--cc=sumit.garg@kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=vdonnefort@google.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox